Trojan.Encoder.26881

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] '<File name>.exe' = '%TEMP%\Adobe\<File name>.exe'

Creates or modifies the following files:

%ALLUSERSPROFILE%\Start Menu\Programs\Startup\README_4251480.txt
%HOMEPATH%\Start Menu\Programs\Startup\README_4251480.txt

Infects the following executable files:

C:\Far2\Far.exe
C:\Far2\Plugins\Compare\Compare.dll
C:\Far2\Plugins\DrawLine\DrawLine.dll
C:\Far2\Plugins\EditCase\EditCase.dll
C:\Far2\Plugins\EMenu\EMenu.dll
C:\Far2\Plugins\ExtSearch\esearch.dll
C:\Far2\Plugins\FarCmds\FARCmds.dll
C:\Far2\Plugins\FTP\FarFtp.dll
C:\Far2\Plugins\arclite\7z.dll
C:\Far2\Plugins\FTP\lib\ftpDirList.fll
C:\Far2\Plugins\FTP\lib\ftpProgress.fll
C:\Far2\Plugins\HlfViewer\HlfViewer.dll
C:\Far2\Plugins\MacroView\MacroView.dll
C:\Far2\Plugins\Network\Network.dll
C:\Far2\Plugins\ProcList\Proclist.dll
C:\Far2\Plugins\Colorer\bin\colorer.dll
C:\Far2\Plugins\Brackets\Brackets.dll
C:\Far2\Plugins\AutoWrap\AutoWrap.dll
C:\Far2\Plugins\arclite\arclite.dll
C:\Far2\Plugins\arclite\7zSD.sfx
C:\Far2\Plugins\arclite\7zS2con.sfx
C:\Far2\Plugins\arclite\7zS2.sfx
C:\Far2\Plugins\arclite\7zCon.sfx
C:\Far2\Plugins\arclite\7z.sfx
C:\Far2\Plugins\FileCase\FileCase.dll
C:\Far2\Plugins\Align\Align.dll
C:\Far2\Plugins\7-Zip\7z.dll
C:\Far2\Plugins\7-Zip\7-ZipFar64.dll
C:\Far2\Plugins\7-Zip\7-ZipFar.dll
C:\Far2\FExcept\FExcept.dll
C:\Far2\FExcept\ExcDump.dll
C:\Far2\FExcept\demangle32.dll
C:\Far2\Plugins\TmpPanel\TmpPanel.dll
C:\Far2\Plugins\WinSCP\WinSCP.dll

Malicious functions:

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Task Manager (Taskmgr)

Reads files which store third party applications passwords:

%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\signons.sqlite

Modifies file system:

Creates the following files:

%TEMP%\Adobe\<File name>.exe
C:\Far2\README_4251480.txt
C:\Far2\PluginSDK\README_4251480.txt
C:\Far2\PluginSDK\Headers.pas\README_4251480.txt
C:\Far2\PluginSDK\Headers.c\README_4251480.txt
C:\Far2\Plugins\README_4251480.txt
C:\Far2\Plugins\WinSCP\README_4251480.txt
C:\Far2\Plugins\WinSCP\windows\README_4251480.txt
C:\Far2\Plugins\WinSCP\release\README_4251480.txt
C:\Muldrop\7-ZjqEoh.moh_0
C:\Far2\Plugins\WinSCP\putty\README_4251480.txt
C:\Far2\Plugins\WinSCP\putty\windows\README_4251480.txt
C:\Far2\Plugins\WinSCP\putty\charset\README_4251480.txt
C:\Far2\Plugins\WinSCP\packages\README_4251480.txt
C:\Far2\Plugins\WinSCP\packages\theme\README_4251480.txt
C:\Far2\Plugins\WinSCP\packages\tbx\README_4251480.txt
C:\Far2\Plugins\WinSCP\resource\README_4251480.txt
C:\Far2\Plugins\WinSCP\console\README_4251480.txt
C:\Muldrop\7-ZjqFbs.emm_0
C:\Muldrop\AmuR.sfh_0
C:\Muldrop\AmuMfov.sfh_0
C:\Muldrop\AmjhoRvt.moh_0
C:\Muldrop\AmjhoEoh.moh_0
C:\Muldrop\Amjho.nbq_0
C:\Muldrop\Amjho.emm_0
C:\Muldrop\7aTpFbs.joj_0
C:\Far2\Plugins\WinSCP\packages\tb2k\README_4251480.txt
C:\Muldrop\7-ZjqEoh.img_0
C:\Muldrop\7aS2.tgy_0
C:\Muldrop\7aCpo.tgy_0
C:\Muldrop\7a.tgy_0
C:\Muldrop\7a.emm_2
C:\Muldrop\7a.emm_0
C:\Muldrop\7-ZjqRvt.moh_0
C:\Muldrop\7-ZjqRvt.img_0
C:\Muldrop\7aS2dpo.tgy_0
C:\Muldrop\7-ZjqFbs64.emm_0
C:\Far2\Plugins\WinSCP\packages\my\README_4251480.txt
C:\Far2\Plugins\WinSCP\packages\filemng\README_4251480.txt
C:\Far2\Plugins\WinSCP\packages\dragndrop\README_4251480.txt
C:\Far2\Plugins\Colorer\README_4251480.txt
C:\Far2\Plugins\ExtSearch\sources\RegExp\README_4251480.txt
C:\Far2\Plugins\ExtSearch\keys\README_4251480.txt
C:\Far2\Plugins\ExtSearch\doc\README_4251480.txt
C:\Far2\Plugins\EMenu\README_4251480.txt
C:\Far2\Plugins\EditCase\README_4251480.txt
C:\Far2\Plugins\DrawLine\README_4251480.txt
C:\Muldrop\AmuSdsffot.sfh_0
C:\Far2\Plugins\ExtSearch\README_4251480.txt
C:\Far2\Plugins\Colorer\hrd\README_4251480.txt
C:\Far2\Plugins\Colorer\hrd\console\README_4251480.txt
C:\Far2\Plugins\Colorer\hrd\console\contrib\README_4251480.txt
C:\Far2\Plugins\Colorer\hrc\README_4251480.txt
C:\Far2\Plugins\Colorer\hrc\auto\README_4251480.txt
C:\Far2\Plugins\Colorer\hrc\auto\types\README_4251480.txt
C:\Far2\Plugins\Colorer\bin\README_4251480.txt
C:\Far2\Plugins\Compare\README_4251480.txt
C:\Muldrop\7aSD.tgy_0
C:\Far2\Plugins\FarCmds\README_4251480.txt
C:\Far2\Plugins\FTP\README_4251480.txt
C:\Far2\Plugins\FileCase\README_4251480.txt
C:\Far2\Plugins\WinSCP\lib\README_4251480.txt
C:\Far2\Plugins\WinSCP\forms\README_4251480.txt
C:\Far2\Plugins\WinSCP\filezilla\README_4251480.txt
C:\Far2\Plugins\WinSCP\filezilla\misc\README_4251480.txt
C:\Far2\Plugins\WinSCP\fari\README_4251480.txt
C:\Far2\Plugins\WinSCP\far\README_4251480.txt
C:\Far2\Plugins\FTP\lib\README_4251480.txt
C:\Far2\Plugins\WinSCP\dragext\README_4251480.txt
C:\Far2\Plugins\ExtSearch\sources\README_4251480.txt
C:\Far2\Plugins\WinSCP\components\README_4251480.txt
C:\Far2\Plugins\TmpPanel\README_4251480.txt
C:\Far2\Plugins\ProcList\README_4251480.txt
C:\Far2\Plugins\Network\README_4251480.txt
C:\Far2\Plugins\MacroView\README_4251480.txt
C:\Far2\Plugins\HlfViewer\README_4251480.txt
C:\Far2\Plugins\WinSCP\core\README_4251480.txt
C:\Muldrop\CbtfRvt.img_0
C:\Muldrop\Dftdsjqu.jpo_2
C:\Muldrop\Aqqt.sfh_0
C:\Muldrop\cpplnbslt-2011-11-10.ktpo_0
C:\Muldrop\CpnqRvt.moh_0
C:\Muldrop\CpnqEoh.moh_0
C:\Muldrop\Cpnqbsf.nbq_0
C:\Muldrop\Cpnqbsf.emm_0
C:\Muldrop\Cpmpst_gspn_Sbepwpk.sfh_2
C:\Muldrop\Cpmpst_gspn_Sbepwpk.sfh_0
C:\Muldrop\Cpmpst_gspn_Gfsojdifolp.sfh_0
C:\Muldrop\CREGEXP.CPP_0
C:\Muldrop\Cpmpst_gspn_benjo_fttq_sv.sfh_2
C:\Muldrop\Cpmpst_gspn_benjo_fttq_sv.sfh_0
C:\Muldrop\CnqRvt.img_0
C:\Muldrop\CnqEoh.img_0
C:\Muldrop\cmvf.ise_0
C:\Muldrop\CmfbsPmvhjotCbdif.dne_0
C:\Muldrop\Cpmpst_gspn_Gfsojdifolp.sfh_2
C:\Muldrop\AmuSfbsdi.sfh_0
C:\Muldrop\CREGEXP.H_0
C:\Muldrop\Dftdsjqu.jpo_16
C:\Muldrop\Dftdsjqu.jpo_14
C:\Muldrop\Dftdsjqu.jpo_12
C:\Muldrop\Dftdsjqu.jpo_10
C:\Muldrop\Dftdsjqu.jpo_0
C:\Muldrop\dfsu8.ec_0
C:\Muldrop\Dfgbvmu165.sfh_0
C:\Muldrop\cmbdl_tfabm.ise_0
C:\Muldrop\cpplnbslt.iunm_0
C:\Muldrop\dbubmph-ufyu.ynm_0
C:\Muldrop\dbubmph-shc.ynm_0
C:\Muldrop\dbubmph-dpotpmf.ynm_0
C:\Muldrop\Cvtupnjaf Ljolt.vsm_0
C:\Muldrop\CusmSijguX.sfh_0
C:\Muldrop\CusmR.sfh_0
C:\Muldrop\CusmF10.sfh_0
C:\Muldrop\dbubmph.ynm_0
C:\Muldrop\CusmDfm.sfh_0
C:\Muldrop\cmbdl_gspn_Mzpepw.sfh_2
C:\Muldrop\cmbdl_gspn_Mzpepw.sfh_0
C:\Muldrop\cmbdl_gspn_kvmz.sfh_2
C:\Muldrop\BsbdlEoh.img_0
C:\Muldrop\BsbdlRvt.sfh_0
C:\Muldrop\BsbdlRvt.moh_0
C:\Muldrop\BsbdlRvt.img_0
C:\Muldrop\Bsbdlfut.nbq_0
C:\Muldrop\Bsbdlfut.emm_0
C:\Muldrop\BsbdlEoh.sfh_0
C:\Muldrop\AmuX.sfh_0
C:\Muldrop\bsdmjuf.nbq_0
C:\Muldrop\BsbdlDfm.sfh_0
C:\Muldrop\Bmvf ijmmt.kqh_0
C:\Muldrop\Bffuipwfo't Sznqipoz Np. 9 (Sdifsap).xnb_0
C:\Muldrop\AvupWsbq.nbq_0
C:\Muldrop\AvupWsbq.emm_0
C:\Muldrop\Asd.Svqqpsu.uyu_2
C:\Muldrop\Asd.Svqqpsu.uyu_0
C:\Muldrop\BsbdlEoh.moh_0
C:\Far2\Plugins\Brackets\README_4251480.txt
C:\Muldrop\bsdmjuf_foh.img_0
C:\Muldrop\bsdmjuf_svt.moh_0
C:\Muldrop\bsdmjuf_foh.moh_0
C:\Muldrop\cmbdl_gspn_kvmz.sfh_0
C:\Muldrop\cmbdl_gspn_Fpobsfw.sfh_2
C:\Muldrop\cmbdl_gspn_Fpobsfw.sfh_0
C:\Muldrop\cmbdl_bz.ise_0
C:\Muldrop\cmbdl.ise_0
C:\Muldrop\CLOCALE.H_0
C:\Muldrop\bsdmjuf_svt.img_0
C:\Muldrop\CLOCALE.CPP_0
C:\Muldrop\bsdmjuf.emm_0
C:\Muldrop\CbtfEoh.moh_0
C:\Muldrop\CbtfEoh.img_0
C:\Muldrop\c662fg49.fyf_0
C:\Muldrop\bvup.kbs_0
C:\Muldrop\Bvh.Rfqpsu.uyu_2
C:\Muldrop\Bvh.Rfqpsu.uyu_0
C:\Muldrop\CbtfRvt.moh_0
C:\Muldrop\ddtrm.isd_0
C:\Far2\Plugins\AutoWrap\README_4251480.txt
C:\Far2\Addons\XLat\README_4251480.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\README_4251480.txt
C:\Documents and Settings\LocalService\Cookies\README_4251480.txt
C:\Documents and Settings\LocalService\Application Data\README_4251480.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\README_4251480.txt
C:\Documents and Settings\Default User\README_4251480.txt
C:\Documents and Settings\Default User\Templates\README_4251480.txt
C:\Documents and Settings\Default User\Start Menu\README_4251480.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\README_4251480.txt
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\README_4251480.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\README_4251480.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\README_4251480.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\README_4251480.txt
C:\Documents and Settings\Default User\SendTo\README_4251480.txt
C:\Documents and Settings\Default User\Recent\README_4251480.txt
C:\Documents and Settings\Default User\PrintHood\README_4251480.txt
C:\Documents and Settings\Default User\Start Menu\Programs\README_4251480.txt
C:\Documents and Settings\Default User\Application Data\README_4251480.txt
C:\Documents and Settings\LocalService\Local Settings\History\README_4251480.txt
%APPDATA%\Identities\README_4251480.txt
%APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\README_4251480.txt
C:\Documents and Settings\NetworkService\README_4251480.txt
C:\Documents and Settings\NetworkService\Local Settings\README_4251480.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\README_4251480.txt
C:\Documents and Settings\NetworkService\Local Settings\Temp\README_4251480.txt
C:\Documents and Settings\NetworkService\Local Settings\History\README_4251480.txt
C:\Documents and Settings\Default User\NetHood\README_4251480.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\README_4251480.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\README_4251480.txt
C:\Documents and Settings\NetworkService\Cookies\README_4251480.txt
C:\Documents and Settings\NetworkService\Application Data\README_4251480.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\README_4251480.txt
C:\Documents and Settings\LocalService\README_4251480.txt
C:\Documents and Settings\LocalService\Local Settings\README_4251480.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\README_4251480.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\README_4251480.txt
C:\Documents and Settings\LocalService\Local Settings\Temp\README_4251480.txt
C:\Documents and Settings\Default User\My Documents\README_4251480.txt
C:\Documents and Settings\Default User\Local Settings\README_4251480.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\README_4251480.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\README_4251480.txt
%ALLUSERSPROFILE%\Favorites\README_4251480.txt
%ALLUSERSPROFILE%\DRM\README_4251480.txt
%ALLUSERSPROFILE%\Documents\README_4251480.txt
%ALLUSERSPROFILE%\Documents\My Videos\README_4251480.txt
%ALLUSERSPROFILE%\Documents\My Pictures\README_4251480.txt
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\README_4251480.txt
%APPDATA%\Microsoft\README_4251480.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\README_4251480.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\README_4251480.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\README_4251480.txt
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\README_4251480.txt
%ALLUSERSPROFILE%\Desktop\README_4251480.txt
%ALLUSERSPROFILE%\Application Data\README_4251480.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\README_4251480.txt
<Current directory>\README_4251480.txt
%ALLUSERSPROFILE%\Documents\My Music\README_4251480.txt
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\README_4251480.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\README_4251480.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\README_4251480.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\README_4251480.txt
C:\Documents and Settings\Default User\Local Settings\Temp\README_4251480.txt
C:\Documents and Settings\Default User\Local Settings\History\README_4251480.txt
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\README_4251480.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\README_4251480.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\README_4251480.txt
C:\Documents and Settings\Default User\Favorites\README_4251480.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\README_4251480.txt
C:\Documents and Settings\Default User\Desktop\README_4251480.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\README_4251480.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\README_4251480.txt
%ALLUSERSPROFILE%\README_4251480.txt
%ALLUSERSPROFILE%\Templates\README_4251480.txt
%ALLUSERSPROFILE%\Start Menu\README_4251480.txt
%ALLUSERSPROFILE%\Start Menu\Programs\README_4251480.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Games\README_4251480.txt
C:\Documents and Settings\Default User\Cookies\README_4251480.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\README_4251480.txt
C:\Far2\Plugins\Align\README_4251480.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\README_4251480.txt
%HOMEPATH%\Start Menu\Programs\Accessories\README_4251480.txt
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\README_4251480.txt
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\README_4251480.txt
%HOMEPATH%\SendTo\README_4251480.txt
%HOMEPATH%\Recent\README_4251480.txt
%HOMEPATH%\PrintHood\README_4251480.txt
%HOMEPATH%\NetHood\README_4251480.txt
%HOMEPATH%\My Documents\My Received Files\README_4251480.txt
%HOMEPATH%\Start Menu\README_4251480.txt
%HOMEPATH%\My Documents\My Pictures\README_4251480.txt
%HOMEPATH%\My Documents\My Music\README_4251480.txt
%HOMEPATH%\My Documents\Downloads\README_4251480.txt
%HOMEPATH%\Local Settings\README_4251480.txt
%HOMEPATH%\Local Settings\<INETFILES>\README_4251480.txt
%TEMP%\README_4251480.txt
%HOMEPATH%\My Documents\README_4251480.txt
%APPDATA%\Mozilla\Extensions\README_4251480.txt
%HOMEPATH%\Templates\README_4251480.txt
C:\Far2\Plugins\7-Zip\README_4251480.txt
C:\Far2\FExcept\README_4251480.txt
C:\Far2\Encyclopedia\README_4251480.txt
C:\Far2\Documentation\README_4251480.txt
C:\Far2\Documentation\rus\README_4251480.txt
C:\Far2\Documentation\eng\README_4251480.txt
C:\Far2\Addons\README_4251480.txt
%HOMEPATH%\Local Settings\History\README_4251480.txt
%HOMEPATH%\Start Menu\Programs\README_4251480.txt
C:\Far2\Addons\Shell\README_4251480.txt
C:\Far2\Addons\SetUp\README_4251480.txt
C:\Far2\Addons\Macros\README_4251480.txt
C:\Far2\Addons\Colors\README_4251480.txt
C:\Far2\Addons\Colors\Default Highlighting\README_4251480.txt
C:\Far2\Addons\Colors\Custom Highlighting\README_4251480.txt
C:\Documents and Settings\README_4251480.txt
C:\Far2\Addons\XLat\Russian\README_4251480.txt
%HOMEPATH%\README_4251480.txt
%HOMEPATH%\Local Settings\History\History.IE5\README_4251480.txt
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\README_4251480.txt
<LS_APPDATA>\README_4251480.txt
%HOMEPATH%\Favorites\Links\README_4251480.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\README_4251480.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\README_4251480.txt
<LS_APPDATA>\Microsoft\README_4251480.txt
<LS_APPDATA>\Identities\README_4251480.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\README_4251480.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\README_4251480.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\README_4251480.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\README_4251480.txt
%HOMEPATH%\Desktop\README_4251480.txt
%HOMEPATH%\Cookies\README_4251480.txt
%APPDATA%\README_4251480.txt
%APPDATA%\Mozilla\README_4251480.txt
%APPDATA%\Mozilla\Firefox\README_4251480.txt
%APPDATA%\Mozilla\Firefox\Profiles\README_4251480.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\README_4251480.txt
%HOMEPATH%\Favorites\README_4251480.txt
C:\Far2\Plugins\arclite\README_4251480.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\README_4251480.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\README_4251480.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\README_4251480.txt
<LS_APPDATA>\VMware\README_4251480.txt
<LS_APPDATA>\Mozilla\README_4251480.txt
<LS_APPDATA>\Mozilla\Firefox\README_4251480.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\README_4251480.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\README_4251480.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\README_4251480.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\README_4251480.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\README_4251480.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\README_4251480.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\README_4251480.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\README_4251480.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\README_4251480.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\README_4251480.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\README_4251480.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\README_4251480.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\README_4251480.txt
C:\Muldrop\Dftdsjqu.jpo_4

Moves the following files:

from %APPDATA%\winscp.rnd to %APPDATA%\d2luc2NwLnJuZA==
from C:\Muldrop\cmvf.ise_0 to C:\Muldrop\Y212Zi5pc2VfMA==
from C:\Muldrop\CmfbsPmvhjotCbdif.dne_0 to C:\Muldrop\Q21mYnNQbXZoam90Q2JkaWYuZG5lXzA=
from C:\Muldrop\cmbdl_tfabm.ise_0 to C:\Muldrop\Y21iZGxfdGZhYm0uaXNlXzA=
from C:\Muldrop\cmbdl_gspn_Mzpepw.sfh_2 to C:\Muldrop\Y21iZGxfZ3Nwbl9NenBlcHcuc2ZoXzI=
from C:\Muldrop\cmbdl_gspn_Mzpepw.sfh_0 to C:\Muldrop\Y21iZGxfZ3Nwbl9NenBlcHcuc2ZoXzA=
from C:\Muldrop\cmbdl_gspn_kvmz.sfh_2 to C:\Muldrop\Y21iZGxfZ3Nwbl9rdm16LnNmaF8y
from C:\Muldrop\cmbdl_gspn_kvmz.sfh_0 to C:\Muldrop\Y21iZGxfZ3Nwbl9rdm16LnNmaF8w
from C:\Muldrop\cmbdl_gspn_Fpobsfw.sfh_2 to C:\Muldrop\Y21iZGxfZ3Nwbl9GcG9ic2Z3LnNmaF8y
from C:\Muldrop\cmbdl_gspn_Fpobsfw.sfh_0 to C:\Muldrop\Y21iZGxfZ3Nwbl9GcG9ic2Z3LnNmaF8w
from C:\Muldrop\cmbdl_bz.ise_0 to C:\Muldrop\Y21iZGxfYnouaXNlXzA=
from C:\Muldrop\cmbdl.ise_0 to C:\Muldrop\Y21iZGwuaXNlXzA=
from C:\Muldrop\CLOCALE.H_0 to C:\Muldrop\Q0xPQ0FMRS5IXzA=
from C:\Muldrop\CLOCALE.CPP_0 to C:\Muldrop\Q0xPQ0FMRS5DUFBfMA==
from C:\Muldrop\CnqRvt.img_0 to C:\Muldrop\Q25xUnZ0LmltZ18w
from C:\Muldrop\CnqEoh.img_0 to C:\Muldrop\Q25xRW9oLmltZ18w
from C:\Muldrop\CbtfEoh.moh_0 to C:\Muldrop\Q2J0ZkVvaC5tb2hfMA==
from C:\Muldrop\CbtfEoh.img_0 to C:\Muldrop\Q2J0ZkVvaC5pbWdfMA==
from C:\Muldrop\c662fg49.fyf_0 to C:\Muldrop\YzY2MmZnNDkuZnlmXzA=
from C:\Muldrop\bvup.kbs_0 to C:\Muldrop\YnZ1cC5rYnNfMA==
from C:\Muldrop\Bvh.Rfqpsu.uyu_2 to C:\Muldrop\QnZoLlJmcXBzdS51eXVfMg==
from C:\Muldrop\Bvh.Rfqpsu.uyu_0 to C:\Muldrop\QnZoLlJmcXBzdS51eXVfMA==
from C:\Muldrop\bsdmjuf_svt.moh_0 to C:\Muldrop\YnNkbWp1Zl9zdnQubW9oXzA=
from C:\Muldrop\bsdmjuf_svt.img_0 to C:\Muldrop\YnNkbWp1Zl9zdnQuaW1nXzA=
from C:\Muldrop\bsdmjuf_foh.moh_0 to C:\Muldrop\YnNkbWp1Zl9mb2gubW9oXzA=
from C:\Muldrop\bsdmjuf_foh.img_0 to C:\Muldrop\YnNkbWp1Zl9mb2guaW1nXzA=
from C:\Muldrop\bsdmjuf.nbq_0 to C:\Muldrop\YnNkbWp1Zi5uYnFfMA==
from C:\Muldrop\bsdmjuf.emm_0 to C:\Muldrop\YnNkbWp1Zi5lbW1fMA==
from C:\Muldrop\BsbdlRvt.sfh_0 to C:\Muldrop\QnNiZGxSdnQuc2ZoXzA=
from C:\Muldrop\CbtfRvt.moh_0 to C:\Muldrop\Q2J0ZlJ2dC5tb2hfMA==
from C:\Muldrop\7-ZjqFbs64.emm_0 to C:\Muldrop\Ny1aanFGYnM2NC5lbW1fMA==
from C:\Muldrop\Cpmpst_gspn_benjo_fttq_sv.sfh_0 to C:\Muldrop\Q3BtcHN0X2dzcG5fYmVuam9fZnR0cV9zdi5zZmhfMA==
from C:\Muldrop\Dftdsjqu.jpo_16 to C:\Muldrop\RGZ0ZHNqcXUuanBvXzE2
from C:\Muldrop\Dftdsjqu.jpo_14 to C:\Muldrop\RGZ0ZHNqcXUuanBvXzE0
from C:\Muldrop\Dftdsjqu.jpo_12 to C:\Muldrop\RGZ0ZHNqcXUuanBvXzEy
from C:\Muldrop\Dftdsjqu.jpo_10 to C:\Muldrop\RGZ0ZHNqcXUuanBvXzEw
from C:\Muldrop\Dftdsjqu.jpo_0 to C:\Muldrop\RGZ0ZHNqcXUuanBvXzA=
from C:\Muldrop\dfsu8.ec_0 to C:\Muldrop\ZGZzdTguZWNfMA==
from C:\Muldrop\Dfgbvmu165.sfh_0 to C:\Muldrop\RGZnYnZtdTE2NS5zZmhfMA==
from C:\Muldrop\ddtrm.isd_0 to C:\Muldrop\ZGR0cm0uaXNkXzA=
from C:\Muldrop\dbubmph.ynm_0 to C:\Muldrop\ZGJ1Ym1waC55bm1fMA==
from C:\Muldrop\dbubmph-ufyu.ynm_0 to C:\Muldrop\ZGJ1Ym1waC11Znl1LnlubV8w
from C:\Muldrop\dbubmph-shc.ynm_0 to C:\Muldrop\ZGJ1Ym1waC1zaGMueW5tXzA=
from C:\Muldrop\dbubmph-dpotpmf.ynm_0 to C:\Muldrop\ZGJ1Ym1waC1kcG90cG1mLnlubV8w
from C:\Muldrop\Cvtupnjaf Ljolt.vsm_0 to C:\Muldrop\Q3Z0dXBuamFmIExqb2x0LnZzbV8w
from C:\Muldrop\CusmSijguX.sfh_0 to C:\Muldrop\Q3VzbVNpamd1WC5zZmhfMA==
from C:\Muldrop\CusmR.sfh_0 to C:\Muldrop\Q3VzbVIuc2ZoXzA=
from C:\Muldrop\CusmF10.sfh_0 to C:\Muldrop\Q3VzbUYxMC5zZmhfMA==
from C:\Muldrop\CusmDfm.sfh_0 to C:\Muldrop\Q3VzbURmbS5zZmhfMA==
from C:\Muldrop\CREGEXP.H_0 to C:\Muldrop\Q1JFR0VYUC5IXzA=
from C:\Muldrop\CREGEXP.CPP_0 to C:\Muldrop\Q1JFR0VYUC5DUFBfMA==
from C:\Muldrop\cpplnbslt.iunm_0 to C:\Muldrop\Y3BwbG5ic2x0Lml1bm1fMA==
from C:\Muldrop\cpplnbslt-2011-11-10.ktpo_0 to C:\Muldrop\Y3BwbG5ic2x0LTIwMTEtMTEtMTAua3Rwb18w
from C:\Muldrop\CpnqRvt.moh_0 to C:\Muldrop\Q3BucVJ2dC5tb2hfMA==
from C:\Muldrop\CpnqEoh.moh_0 to C:\Muldrop\Q3BucUVvaC5tb2hfMA==
from C:\Muldrop\Cpnqbsf.nbq_0 to C:\Muldrop\Q3BucWJzZi5uYnFfMA==
from C:\Muldrop\Cpnqbsf.emm_0 to C:\Muldrop\Q3BucWJzZi5lbW1fMA==
from C:\Muldrop\Cpmpst_gspn_Sbepwpk.sfh_2 to C:\Muldrop\Q3BtcHN0X2dzcG5fU2JlcHdway5zZmhfMg==
from C:\Muldrop\Cpmpst_gspn_Sbepwpk.sfh_0 to C:\Muldrop\Q3BtcHN0X2dzcG5fU2JlcHdway5zZmhfMA==
from C:\Muldrop\Cpmpst_gspn_Gfsojdifolp.sfh_2 to C:\Muldrop\Q3BtcHN0X2dzcG5fR2Zzb2pkaWZvbHAuc2ZoXzI=
from C:\Muldrop\Cpmpst_gspn_Gfsojdifolp.sfh_0 to C:\Muldrop\Q3BtcHN0X2dzcG5fR2Zzb2pkaWZvbHAuc2ZoXzA=
from C:\Muldrop\BsbdlRvt.moh_0 to C:\Muldrop\QnNiZGxSdnQubW9oXzA=
from C:\Muldrop\CbtfRvt.img_0 to C:\Muldrop\Q2J0ZlJ2dC5pbWdfMA==
from C:\Muldrop\BsbdlRvt.img_0 to C:\Muldrop\QnNiZGxSdnQuaW1nXzA=
from C:\Muldrop\Bsbdlfut.nbq_0 to C:\Muldrop\QnNiZGxmdXQubmJxXzA=
from C:\Muldrop\Bsbdlfut.emm_0 to C:\Muldrop\QnNiZGxmdXQuZW1tXzA=
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\permissions.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cGVybWlzc2lvbnMuc3FsaXRl
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userContent-example.css to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\dXNlckNvbnRlbnQtZXhhbXBsZS5jc3M=
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userChrome-example.css to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\dXNlckNocm9tZS1leGFtcGxlLmNzcw==
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\bookmarks-2011-11-10.json to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\Ym9va21hcmtzLTIwMTEtMTEtMTAuanNvbg==
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\webappsstore.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\d2ViYXBwc3N0b3JlLnNxbGl0ZQ==
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\signons.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\c2lnbm9ucy5zcWxpdGU=
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\c2Vzc2lvbnN0b3JlLmpz
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\c2Vzc2lvbnN0b3JlLmJhaw==
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\c2VjbW9kLmRi
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\c2VhcmNoLnNxbGl0ZQ==
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.json to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\c2VhcmNoLmpzb24=
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cHJlZnMuanM=
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\pluginreg.dat to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cGx1Z2lucmVnLmRhdA==
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\places.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cGxhY2VzLnNxbGl0ZQ==
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\mimeTypes.rdf to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bWltZVR5cGVzLnJkZg==
from C:\Muldrop\7-ZjqEoh.moh_0 to C:\Muldrop\Ny1aanFFb2gubW9oXzA=
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\localstore.rdf to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bG9jYWxzdG9yZS5yZGY=
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\a2V5My5kYg==
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\formhistory.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Zm9ybWhpc3Rvcnkuc3FsaXRl
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\ZXh0ZW5zaW9ucy5zcWxpdGU=
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.ini to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\ZXh0ZW5zaW9ucy5pbmk=
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\downloads.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\ZG93bmxvYWRzLnNxbGl0ZQ==
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cookies.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Y29va2llcy5zcWxpdGU=
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\content-prefs.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Y29udGVudC1wcmVmcy5zcWxpdGU=
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\compatibility.ini to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Y29tcGF0aWJpbGl0eS5pbmk=
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chromeappsstore.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Y2hyb21lYXBwc3N0b3JlLnNxbGl0ZQ==
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Y2VydDguZGI=
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarks.html to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Ym9va21hcmtzLmh0bWw=
from %APPDATA%\Mozilla\Firefox\profiles.ini to %APPDATA%\Mozilla\Firefox\cHJvZmlsZXMuaW5p
from C:\Muldrop\Dftdsjqu.jpo_2 to C:\Muldrop\RGZ0ZHNqcXUuanBvXzI=
from C:\Muldrop\Cpmpst_gspn_benjo_fttq_sv.sfh_2 to C:\Muldrop\Q3BtcHN0X2dzcG5fYmVuam9fZnR0cV9zdi5zZmhfMg==
from C:\Muldrop\7-ZjqFbs.emm_0 to C:\Muldrop\Ny1aanFGYnMuZW1tXzA=
from C:\Muldrop\7-ZjqRvt.moh_0 to C:\Muldrop\Ny1aanFSdnQubW9oXzA=
from C:\Muldrop\7-ZjqEoh.img_0 to C:\Muldrop\Ny1aanFFb2guaW1nXzA=
from C:\Muldrop\BsbdlEoh.sfh_0 to C:\Muldrop\QnNiZGxFb2guc2ZoXzA=
from C:\Muldrop\BsbdlEoh.moh_0 to C:\Muldrop\QnNiZGxFb2gubW9oXzA=
from C:\Muldrop\BsbdlEoh.img_0 to C:\Muldrop\QnNiZGxFb2guaW1nXzA=
from C:\Muldrop\BsbdlDfm.sfh_0 to C:\Muldrop\QnNiZGxEZm0uc2ZoXzA=
from C:\Muldrop\Bmvf ijmmt.kqh_0 to C:\Muldrop\Qm12ZiBpam1tdC5rcWhfMA==
from C:\Muldrop\Bffuipwfo't Sznqipoz Np. 9 (Sdifsap).xnb_0 to C:\Muldrop\QmZmdWlwd2ZvJ3QgU3pucWlwb3ogTnAuIDkgKFNkaWZzYXApLnhuYl8w
from C:\Muldrop\AvupWsbq.nbq_0 to C:\Muldrop\QXZ1cFdzYnEubmJxXzA=
from C:\Muldrop\AvupWsbq.emm_0 to C:\Muldrop\QXZ1cFdzYnEuZW1tXzA=
from C:\Muldrop\Asd.Svqqpsu.uyu_2 to C:\Muldrop\QXNkLlN2cXFwc3UudXl1XzI=
from C:\Muldrop\Asd.Svqqpsu.uyu_0 to C:\Muldrop\QXNkLlN2cXFwc3UudXl1XzA=
from C:\Muldrop\Aqqt.sfh_0 to C:\Muldrop\QXFxdC5zZmhfMA==
from C:\Muldrop\AmuX.sfh_0 to C:\Muldrop\QW11WC5zZmhfMA==
from C:\Muldrop\AmuSfbsdi.sfh_0 to C:\Muldrop\QW11U2Zic2RpLnNmaF8w
from C:\Muldrop\AmuSdsffot.sfh_0 to C:\Muldrop\QW11U2RzZmZvdC5zZmhfMA==
from C:\Muldrop\AmuR.sfh_0 to C:\Muldrop\QW11Ui5zZmhfMA==
from C:\Muldrop\AmuMfov.sfh_0 to C:\Muldrop\QW11TWZvdi5zZmhfMA==
from C:\Muldrop\AmjhoRvt.moh_0 to C:\Muldrop\QW1qaG9SdnQubW9oXzA=
from C:\Muldrop\AmjhoEoh.moh_0 to C:\Muldrop\QW1qaG9Fb2gubW9oXzA=
from C:\Muldrop\Amjho.nbq_0 to C:\Muldrop\QW1qaG8ubmJxXzA=
from C:\Muldrop\Amjho.emm_0 to C:\Muldrop\QW1qaG8uZW1tXzA=
from C:\Muldrop\7aTpFbs.joj_0 to C:\Muldrop\N2FUcEZicy5qb2pfMA==
from C:\Muldrop\7aSD.tgy_0 to C:\Muldrop\N2FTRC50Z3lfMA==
from C:\Muldrop\7aS2dpo.tgy_0 to C:\Muldrop\N2FTMmRwby50Z3lfMA==
from C:\Muldrop\7aS2.tgy_0 to C:\Muldrop\N2FTMi50Z3lfMA==
from C:\Muldrop\7aCpo.tgy_0 to C:\Muldrop\N2FDcG8udGd5XzA=
from C:\Muldrop\7a.tgy_0 to C:\Muldrop\N2EudGd5XzA=
from C:\Muldrop\7a.emm_2 to C:\Muldrop\N2EuZW1tXzI=
from C:\Muldrop\7a.emm_0 to C:\Muldrop\N2EuZW1tXzA=
from C:\Muldrop\7-ZjqRvt.img_0 to C:\Muldrop\Ny1aanFSdnQuaW1nXzA=
from C:\Muldrop\Dftdsjqu.jpo_4 to C:\Muldrop\RGZ0ZHNqcXUuanBvXzQ=

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней